← Cybersecurity Headlines
Cybersecurity Headlines
Week in Review: Data breach impact study, US weighs TP-Link ban, BeyondTrust cyberattack
00:28:08
Loading summary
Transcript37 lines
- [00:00]
Rich Strofolino
From the CISO series, it's cybersecurity headlines, a look at the business impact of data breaches, US Way's TP link ban and Beyond Trust suffers a cyber attack. These are some of the stories that my colleagues and I have selected from this past week's cybersecurity headlines. And much like a white elephant gift exchange, we're looking around what's on the table. We're trading stuff. We don't know the rules. We're all kind of mildly annoyed with each other, but we've chosen some stories for some insight, opinion and expertise from our returning guest, Bethany Delude, the CISO over at the Carlyle Group. Bethany, you had such a fun time over the summer. You decided to come back. Thank you so much for joining us. I got to ask them before we jump into the news, how was your week in cybersecurity?
- [00:47]
Bethany Delude
I think my week, Rich, was just like every other ciso. We're thrilled to have budget behind us, having wrapped up our end of year conversations with boards and audit committees. And now we remain, I guess, tiptoeing on eggshells, hoping that bad actors remain on the nice and don't move to the naughty list as we head into the holidays in the new year.
- [01:12]
Rich Strofolino
The sad thing is then you will be the one with Cole in the stocking though, in that formulation. So threat actors, think of Santa at this time of year, I guess is what I'll say. Someone who also has the holiday spirit is of course our sponsor for today, Throw Threat Locker Zero Trust Endpoint Protection Platform. And we have, I see some of our jolly little elves in our chat room today. Of course we have ccl, we have the big boss man, David Spark and Max Tronic reporting in from the office. Thank you so much. We appreciate all of our commenters that are joining us today. I know the holidays are coming up. Time is valuable. So thank you one and all for making the time. If you want to join us live, you can go to the events page@cisoseries.com, look for the Weekend Review image there and you can click on you can join us, subscribe to the YouTube page. You'll find us each and every week. We want those opinions about the stories of the week in our chat, so I cannot wait to see what your thoughts are. And speaking of thoughts, just after a quick reminder that Bethany's opinions are her own, they're not necessarily those of her employer. Disclosures out of the way. Promotions out of the way. We've got about 20 minutes, so let's jump in to the news. First story here, Recorded Future highlights the business impact of data breaches. Russia's favorite tech industry news outlet, Recorded Future, has released a report from its Insect group that's identified a 76% increase in publicly reported data breaches from 2022 to 2023. The group projects a further 5% increase for 2024. They pointed out the costliness of impacts or the costliest impacts of data breaches in the last several years have been operational disruption, legal risks and declining sales due to churn and and loss of customer trust. They add the real risk lies in companies falling behind in their security strategy and failing to adopt a new way of thinking. So, Bethany, pretty substantial pairing legal risks, declining sales and loss of customer trust. You know, you can't just cut a check to solve all of those. Maybe the legal stuff, maybe. But all the rest of those a lot trickier. At the same time, companies falling behind in their cybersecurity strategy, failing to adopt new ways of thinking, shouldn't they be doing more?
- [03:22]
Bethany Delude
Yeah. Well, first I want to say to all my fellow CISOs out there, being a CISO is hard. And when I read that article, coupled with all the other ones that we read, we read the data breach investigation report, the cost of a data breach, and so on. The message as well as in this article with recorded future, is that the threat landscape is increasingly complex and difficult. In addition, the environment that we need to secure is increasingly complex because there's so much that is out of our direct control. There used to be like the notion that we have a traditional boundary with an edge that we can clearly focus on and secure. Well, that's not how modern businesses operate. So there's a lot of increasing reliance and partnership with third parties. Our information landscape really is identity. Like that is your new perimeter. And anywhere that a corporate identity can log in, anywhere that our access is where our data resides, that's our new perimeter. And that's a real shift in how you go about securing an organization do.
- [04:42]
Rich Strofolino
These reports when they come out. I mean, obviously everyone knows that there is a lot of costs that are associated with, with a data breach. Increasingly everyone's dealing with them in some way. Whether they're dealing with a third party, they're dealing with a breach themselves. Data leaked from, from somebody else. Do reports like this help in terms of like a, providing almost like a market response right. To, to this problem? Right. Of like, listen, you're, you know, you're going to lose customers because no one's gonna be able to Trust you that you can secure stuff. You're gonna have be, you know, you're gonna have legal costs are gonna go on for years. Does, does that help solve the second half of that problem? Like, like kind of in a macro level?
- [05:17]
Bethany Delude
Well, where these reports are really helpful is in telling the story. So you can always have a great rip from the headline stories of the bad thing happening and having that quite adverse impact. And then you can use these reports to say, let me, you know, this isn't a one off, this is something that is happening, it's happening more frequently and here's how we're postured against that bad thing happening. So I think, you know, reports like this are really helpful in bring data to the story that you need your leadership to hear and then your partners in the business to be able to really understand how cyber health affects business operations and avoid the many risks that we talked about. We didn't say cyber risk in any of these. Right. We said regulatory risk, brand risk, financial risk. And I think that's key here. You know, use those terms, you know, real data and then contextualize for your business.
- [06:21]
Rich Strofolino
All right, well, our next story here, Rhode island and Connect On Call grapple with data breaches. So two stories this week that highlight that the theft of what appears to be, I don't know, low priority data, things we've just become numb to really, we should be paying attention to. First, Rhode Island's RI Bridges system managed by Deloitte was hit by a ransomware attack likely tied to the Brain Cipher gang. Great guys. Exposing sensitive data like Social Security numbers and banking details of residents applying for public assistance programs. Then Healthcare SAS had to notify over 900,000 patients of a data breach in its Telehealth subsidiary, Connect on Call, which also included health related data. So, Bethany, these types of stories tend to, I guess, fly under the radar because the number isn't crazy necessarily. Rhode island kind of a small state and maybe people feel like there's not much to be gained from stealing a person's health records or maybe even Social Security numbers. Now at this point, in a way, this issue is sitting on the bench alongside infrastructure security while people focus maybe on more high profile heights. Hey, you know, you steal 50 million in crypto or something like that. I'm curious, what do you see as the dangers of these very common health data thefts that we're increasingly seeing targeted?
- [07:38]
Bethany Delude
Yeah, there's been a really nasty twist to these stories over the past year. You're going back to just pick, you know, change Healthcare. Adding to these, which is access to healthcare has been disrupted. You know, people couldn't get prescriptions, they can't do their telehealth visits. And so it's not just about potentially compromising and exposing leaking medical records. It's about access to healthcare. And I think that that's a shift and that will get this more attention or I hope it will get more attention. There's just truly no more honor among thieves. These performing an attack that could potentially cause loss of life used to be off the table. Well now it's fair game because you may get that incentivizes the response that the threat actors want. They want money. Something that I also think gets missed in these stories is in those records. There's a lot of personal information. It's not just a health diagnosis. So this is kind of the gateway to credential theft, identity theft. And I think you're going to see a lot of kind of like with Snowflake this year where you had, I'll call it Snowflake adjacent breaches that were really, because started with credential theft and then there were getting into systems that didn't have the best cyber hygiene. Well now you're giving threat actors the information that's needed to cause much more harm than I have your medical record.
- [09:17]
Rich Strofolino
Well and I can just see just with hey, I got chatgpt, I can throw all these in there and all of a sudden you know, generate some very targeted things very quickly at scale. That to me is, is kind of where I'm like this is like you said, extraordinarily personal information that you can make some very tempting lures that would seem very real to a lot of people, probably myself included. Like, you know, I, I there, there is a lot of potential mayhem that could be caused. I want to give a quick reference to CCL here saying didn' weren't they breaching another incident this year? I do believe that they were with another kind of state or kind of government level system. Now this, I will also say Deloitte does a ton of these different systems that doesn't, I'm not saying that should excuse them from any responsibility or anything like that. I'm sure they're investigating it. They just have an enormous footprint when it comes to stuff like this. And then Maxtronic says no clearinghouse for health data like there is for financial data. So that is a big problem too. I completely agree Maxtronic, thank you for that. Next up here, Beyond Trust suffers cyber issue. Beyond Trust, a cybersecurity Company specializing in privileged access management, not to be mistaken with the nonstick spray PAM and Secure Remote Access Solutions itself suffered a cyber attack on December 2. Its products are used by government agencies, tech firms, retail and e commerce entities, healthcare organizations, energy and utility service providers, and the banking sector. I think we can just say bank by the economy at large. They determined that hackers gained access to a remote support SaaS API key that allowed them to reset passwords for local application accounts. It's not yet clear whether the threat actors were able to use the compromised remote support SaaS instances to breach downstream customers, although it certainly seems like a possibility. You know Bethany, anytime a security company gets victimized by threat actors, it's a very bad day for them, for their customers and for everyone else who engages the services of any other security company. Kind of calls into question the kind of that chain of trust. I'm curious what goes through your mind when you hear about this particular type of attack?
- [11:20]
Bethany Delude
Yeah, well I think this one specifically resonates with me and identity just that identity security is so just table stakes in this environment and to have a breach in what arguably are your most impactful identities if compromised, you know, with any type of privileged access management solution, they are a great product. So it's always you're disappointed when something bad happens to good people. And interesting in reading this there's still not a ton of information but it looks like there were new vulnerabilities discovered and that's led and you led to this outcome. And that I think is going to be a thing theme that we see across 2025. Actually I think there's going to be more zero days, more exploits in my crystal ball prediction. I thought for sure we were going to have another file transfer big breach in 2025 and then I thought identity something in identity management also. So that one's started a little sooner. It's good to get the sense of this one isn't as terrible as it could have been. Knock on wood. So far with what we've been told.
- [12:39]
Rich Strofolino
That'S like the context to put all of these kind of stories. It doesn't appear as bad as it potentially could so far. By the way, I'll double down on that prediction also as well some sage words from Bethany, our oracle here. Before we move on to our next story, I have to spend a few moments and thank our sponsor for today. Threat Locker. Do zero day exploits and supply chain attacks keep you up at night? Worry no more. You can harden your security with ThreatLocker. ThreatLocker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker. All right, next up here, this was one of my favorite stories of the week or favorite sounds. Most interesting stories the Week US Weighs a TP Link Ban Sources from the Wall Street Journal say that investigators at the U.S. commerce, Defense and Justice Departments have all opened separate investigations into the router maker TP Link. The Defense Department is reportedly investigating national security vulnerabilities and the Justice Department will look at if TP link price discrepancies violate antitrust laws for selling below cost. TP Link accounts for roughly 65% of the US home router market, in part due to their low prices. Back in October, Microsoft reported multiple Chinese threat actors were using a botnet made up almost entirely of TP link routers called Covert Network 1658 to compromise Azure accounts. So Bethany, talk about hiding in plain sight. Considering how many people use routers at home, which probably is close to saturation at this point, appears to be quite an explosive story. What's your take on this?
- [14:36]
Bethany Delude
Well, I'm really disappointed it didn't come out before the election because I think anyone who ran on the platform of and you get a secure router would have made my voting decision so much easier.
- [14:51]
Rich Strofolino
Whoever gives me Wi Fi 7 a coupon for some Wi Fi 7, that'd be great, right?
- [14:55]
Bethany Delude
That would be terrific. And then a coupon that would at least normalize pricing on Amazon so that this router is no longer the top selling router. I think I couldn't help but reading the story. I had a flashback. There's that movie Leave the World behind that is a little terrifying about what happens when really critical infrastructure and the technologies that we rely upon every day in our normal lives are controlled no longer by us and for nefarious means. And this story Is it art imitating reality? Is it reality imitating art? I don't know. Either way, I sense I'm going to be having a nightmare at some point this weekend. And yeah, it really is a head scratcher. We already all the stories with Salt Typhoon living in our telecom systems. I really don't want them living in my home.
- [16:02]
Rich Strofolino
Well and it just makes me think like I'm just thinking all of a sudden now of like oh, everyone that's been Doing return, you know, work from home, you know, like, yes, I'm sure a lot of people are those on VPNs, but it's like, it's still the point, you know, if there is a potential point of compromise at the router level, that's just like, it's so bad at so many levels. CCL in the chat says not sure a ban will help. Is there any hardware product that does not have some relation to China and thus vulnerable to supply chain attacks? I do think in some ways this could be an instance of whack a mo. Although you still have to like, like the mole is still there. You still have to, you still have to hit the mole that's like popping its head out. Like I, so like if these, you know, the investigations turn out, obviously they have to take some kind of action. But like, I mean getting someone to upgrade the router already for like just like, oh, it's out of service. Like, you know, it's, it's, you know, the firmware is out of service, end of life or whatever, like that, that alone is, it like is a tough hurdle getting someone to set up a router. You know, I would say the average person that's going to be a, that's going to be a real, you're gonna have to push real hard. Give a lot of carrots to make that happen. I, I, you know that, that market share. Yeah, you could stop the supply, you could stop it now. But like, wow, talk about a long tail, right? That you have to worry about, right?
- [17:17]
Bethany Delude
Yeah, yeah, we definitely, you see things so, so many of the remedies for these risks, you can't just pivot, you know, overnight. You can't, you know, ccl' components are through my, my cell phone likely has a component built in China. So, but I do think there's something to making it harder and you know, like Huawei, you look at what happened when years ago that was quite controversial when there were feet were planted. And what's happening with TikTok today, it's not a linear thought process, but it is good to see consideration being given with how much we outsource what we outsource and therefore what we might want to start investing in differently from a national security and consumer perspective.
- [18:21]
Rich Strofolino
Well, our next story here gets right to my linguistics heart Interpol kills off pig butchering. In recent years, the proliferation of online relationship and investment scams has made pig butchering a fairly common thing you'll hear on cybersecurity headlines. It derives from the idea that threat Actors are metaphorically attempting to fatten up potential victims for a more significant return. If the love scheme goes very deep, then it's easier to extract money out of them for whatever reason. Now Interpol is calling the cybersecurity community, media and law enforcement to retire the term in favor of the more descriptive romance baiting. Europol said, referring to the practice as pig butchering dehumanizes and shames victims. You are calling them a pig in that instance. And that romance baiting highlights the emotional manipulation in these schemes with more emphasis put on the threat actors tactics. This comes as part of a broader effort by Europol to encourage victims of these frauds to come forward to authorities. So, Bethany, is this an accurate and appropriate move or simply attempting to soften the metaphor to avoid traumatizing or offending people? I mean, certainly that by itself a worthy aim here. In other words, is Europol putting lipstick on a pig?
- [19:35]
Bethany Delude
Oh, that may move you to the naughty list. We had you on a very different list. But I have to say, I think language is important. And when you say pig butchering, it's not intuitive. I mean, when you explain it, you're like, oh, okay, that makes sense. But I do think romance baiting, that is a. A bit more intuitive. And if anything, that's done to kind of promote conversation, promote understanding, I support that. So if romance baiting puts the onus more squarely on the person who is victimizing rather than shaming the victim. Because I wouldn't like to tell you that I was pig butchered.
- [20:21]
Rich Strofolino
Yeah, exactly.
- [20:22]
Bethany Delude
Yeah. But if I was part of a romance. Romance baiting thing, well, that's an easier conversation.
- [20:32]
Rich Strofolino
Yeah. And CCL points out, it's. It's a. Just a point of confusion where, you know, romance scam or romance baiting or however we want to call it, like, we already know the lure. Right. Like, it's easier to get into. I do think pig butchering started out probably as a law enforcement like. Like shorthand or something like that that went, you know, that. That then moved into the media as people were speaking to sources and stuff like that. So, like, I don't think it came from a place of malice, but, like, as an industry term, we can. We can do better ways of communicating as these things unfortunately become more common and more seen at scale. So. So, yeah, thank you for that, ccl Completely agree with you, Bethany. You know, a little bit of empathy goes. Goes a long way, it turns out. And, you know, again, doesn't change the dynamics of this, but maybe takes a little Bit of the stigma off. And that alone was probably worth, worth it. All right, and our last story of today, UnitedHealth's AI driven insurance claim chatbot left exposed to the Internet. The healthcare giant Optum has now restricted access to an internal AI chatbot that's been used by employees to inquire about how to handle patient health insurance claims and disputes according to standard operating procedures, or SOPs. This after a researcher from the cybersecurity firm Spider Silk saw that its IP address was accessible online for anyone with a web browser, no password required, Phil Collins style. The chatbot did not appear to contain or produce sensitive personal or protected health information. Now, a spokesperson for Optum, whose parent company is UnitedHealth Group, told TechCrunch in a statement that Optum's SOP chatbot was a demo tool developed as a potential proof of concept, as many qualifications as possible there, but was never put into production and the site is no longer accessible. Obviously a very bad month for UnitedHealth Group. Just from the data security side, just looking at that, this exposed chatbot comes at the same time they've had a lawsuit from the Attorney General of Nebraska over data theft. Of course, it could be possible to accept Optum statement that the SOP chatbot was a provisional demo for a potential proof of concept. But as we know, everything on the Internet is connected to everything else in some way. It's just a matter of discoverability. I'm curious, what are your thoughts about the situation the United Health Group companies find themselves in?
- [22:52]
Bethany Delude
Yeah, so, so when I read this for one, I thought, yes, we are getting an AI story into the headlines.
- [23:00]
Rich Strofolino
Bingo. Card would not be full. Yeah.
- [23:02]
Bethany Delude
Without that. And you know, and part of this, you know, there's what those of us, you know, in the, in the industry know is that whether it was a demo or not, it was trained on data and that that training data could be, could have been exposed through that chatbot. And we don't know exactly in their SOPs, you know, what it is saying or what it would additional if they had a misconfiguration on the accessibility of the chatbot to the Internet, what exactly was the data they used to train it? How protected was that data? Could the data have been pulled out using different prompts? So not trivial. Again, hopefully this is one of those, you got a warning, you know, next time heed that warning so that the next time it isn't something a whole lot worse.
- [23:56]
Rich Strofolino
Yeah. And again, going back to potentially having health information or anything even associated with that is just A just a minefield. And in a way, you know, to your point, I feel almost worse that it's a demo because I have no confidence then that there were any kind of controls that were effective put in place. Because this is still, you know, emerging technology. No. 1. This is not a perfected science for deploying these kind of things. Even if you are going to go on production, let alone a demo, which you only have in place so that you can improve it before production, right?
- [24:29]
Bethany Delude
Oh yeah, and they said that they had, you know, hundreds and hundreds of questions were asked of it and all of the chats were stored. So, you know, it certainly got more than trivial use, you know, as, you know, as a demo.
- [24:46]
Rich Strofolino
We have a question in the chat, can they be forced to report on the access and usage during that time period? I mean, certainly that transparency would be appreciated. I don't think anything in HIPAA or anything like that. I don't believe there'd be any reason you would have to, given the optics. Might not be the worst idea in the world, but, you know, we can hope that it's. It's a season of hope is what I like to say.
- [25:11]
Bethany Delude
It is the season of hope. You're right.
- [25:13]
Rich Strofolino
So we can put our ping, our hopes on a little transparency and we have to be fully transparent. We are just about at the end of the show here before we get out of here, Bethany, was there any story that was a thumbs up or an eye roller either in a rundown or just kind of in the news of the week today?
- [25:28]
Bethany Delude
Yeah, I'm going to actually pick an adjacent headline. Adjacent. That's my word for this podcast. I think this is my third time using it. But it has to do with recorded future and recorded future being determined and undesirable organization in Russia. And I loved how their CEO responded with. This was quite the rare compliment.
- [25:53]
Rich Strofolino
Yeah, I mean, just. Just saying like, like, thank you for. Yes, we take pride in. This is kind of an amazing statement from a CEO.
- [26:01]
Bethany Delude
Yeah, yeah, I had to. That one. That one made me smile.
- [26:05]
Rich Strofolino
And thank you to our producer Steve for alluding to that in our first read. He is a master of copy. So some plaudits for producer Steve Prentiss before we get out of here. Bethany, where can people find you on the cyberspace if they are so inclined?
- [26:20]
Bethany Delude
I am on LinkedIn, so head there and say hi and I plan to stay there.
- [26:27]
Rich Strofolino
Okay. It seems like a good platform for CISOs and for people that like to connect and engage and occasionally offer to sell me courses. So not by saying that you are Bethany. But yeah, there you go. So we'll have a link to that in our show notes. Thank you so much. Bethany Dlude, the CISO over at the Carlyle Group. I really truly appreciate your time coming back. Two time guests here in 2024 getting close to the end of the year. I really appreciate it.
- [26:52]
Bethany Delude
Thank you Rich and wishing all the happiest of New Year's.
- [26:55]
Rich Strofolino
Absolutely. Same to you and yours. Thanks also to our sponsor and a happy new year to our sponsor, Threat Locker Zero Trust Endpoint Protection platform. Thanks to our audience today. We can't always get every single comment up on the screen, but we deeply appreciate you being here participating, helping make the show better. Ccl, Maxtronic, the big boss man, David Spark. All in there. I know it's a busy time of year and your time is valuable. Thank you for sharing it with with us. Just a reminder, there will be no Super Cyber Friday next week, but do come back for another episode of the week in Review starting at 3:30pm Eastern. To register, just head on over to the events page@cisoseries.com in the meantime, you can get your daily news fix through cybersecurity headlines every single day. We're taking Christmas off. Give us about six minutes, we'll get you all caught up. Until the next time we meet. I'm Rich Strofolino reminding you to have a super Sparkly day. Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.